registry / log-llm-config / 1.5.26
log-llm-config@1.5.26
CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package’s network activity is tied to its documented Optimus inventory workflow and configured endpoint. The inspected credential-related collector extracts selected identity claims rather than transmitting the Codex bearer token.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user or configured integration invokes a package CLI entry point.
Impact
The configured Optimus service receives the inventory data for its intended workflow.
Mechanism
Collects configuration inventory and selected usage and identity fields, then sends a signed payload to OPTIMUS_ENDPOINT; the default host is app.optimuslabs.io.
AI rationale
The package’s network activity is tied to its documented Optimus inventory workflow and configured endpoint. The inspected credential-related collector extracts selected identity claims rather than transmitting the Codex bearer token.
Network endpoints2
app.optimuslabs.io/endpoint_security/log-config-files/OPTIMUS_ENDPOINT/startup/
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only lifecycle hook is prepare, which runs the build.
- The README describes hardware UUID and startup-payload collection as the CLI’s purpose.
- The Codex collector extracts selected identity claims from auth.json; the inspected code does not send the bearer token.
- Collected config data is sent to the configured Optimus endpoint, with app.optimuslabs.io as the default host.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggeddist/log_config_files/collection/cowork_desktop_version_collector.jsView file
1import { execFileSync } from 'node:child_process';
L2: import { existsSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/log_config_files/collection/cowork_desktop_version_collector.jsView on unpkg · L1dist/tofu.jsView file
19const tofu = (useLocalTofu
L20: ? await import(localTofuPath)
L21: : await import("optimus-tofu"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/tofu.jsView on unpkg · L19dist/log_config_files/collection/skills_cli_collector.jsView file
Findings
1 Critical4 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/log_config_files/runtime/hardware_uuid.js
HighChild Processdist/log_config_files/collection/cowork_desktop_version_collector.js
HighShell
HighRuntime Package Installdist/log_config_files/collection/skills_cli_collector.js
HighSemantic Analysis Limiteddist/log_config_files/runtime/remediation_sync.js
MediumDynamic Requiredist/tofu.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to log-llm-config@1.5.26.
See all versions of log-llm-config for other recorded verdicts.
- Review the evidence and your use of log-llm-config@1.5.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.